Claude AI discovers hidden crypto miner in Mac temperature monitor app

Key Takeaways

• A developer’s Mac was found running a hidden cryptocurrency miner, XMRig, after an AI assistant, Claude, detected unusually high CPU temperatures and activity.
• The miner was reportedly sustained by a suspicious LaunchAgent entry configured with KeepAlive, ensuring its continuous operation.
• The incident highlights the potential for AI tools to assist in cybersecurity discovery, but also underscores the need for thorough forensic investigation beyond initial reports.
• While the AI reportedly assisted in removing the miner, the full scope of the compromise, including the initial infection vector and potential data exfiltration, remains unconfirmed.

AI Assistant Uncovers Covert Crypto Miner on Mac

An unexpected security revelation unfolded when the AI assistant Claude reportedly identified a hidden cryptocurrency miner operating on a developer’s Mac. The discovery occurred during a routine coding session where Claude was assisting in the creation of a temperature monitoring application. Abnormally high sensor readings prompted the AI to investigate system processes, leading to the detection of XMRig consuming a significant 1,175% of CPU resources, equivalent to approximately 12 processing cores.

The developer, identified as u/UntilHEX on Reddit, stated that Claude initiated a review of running processes after analyzing the raw temperature data. This finding provided a clear explanation for the Mac’s observed performance degradation. However, it is crucial to note that this account is a user-submitted report, supported by a screenshot, and has not been corroborated by an independent forensic analysis.

Excessive CPU Load Betrays Hidden Miner

According to the shared screenshot, Claude reported a CPU temperature peak of 112°C, issuing a stark warning: “Your Mac is running a cryptominer that I didn’t put there.” These figures reflect the reported session details and have not been independently verified through hardware logs or separate examinations.

The screenshot further identified /tmp/rigupdater as the operational location of the miner and pool.hashvault.sh as its designated mining pool. While these details offer valuable starting points for investigators examining the specific device, they do not provide information regarding the software’s initial installation method, the identity of the installer, or whether other systems might be compromised.

It is important to clarify that XMRig itself is not inherently malicious software. It is a legitimate cryptocurrency mining application with official macOS builds, including support for Apple Silicon. The primary security concern arises from its apparent operation without the owner’s knowledge or explicit consent. The mere presence of the program does not automatically confirm an infection; a comprehensive examination of its installation, configuration, and activity is necessary to establish malicious intent.

LaunchAgent Sustained Miner’s Operation

Claude’s investigation also highlighted a suspicious property list file located within ~/Library/LaunchAgents/. The screenshot detailed a randomly named startup entry, dated August 29, which executed a heavily encoded script via bash, with the KeepAlive setting enabled. Claude indicated that this entry was present on the system before its development work commenced.

Apple’s LaunchAgent documentation explains that these user agents operate within a logged-in user’s session. The KeepAlive setting instructs launchd to ensure a job remains active. This makes the startup entry a critical component, as simply terminating a process without disabling its launcher can allow it to automatically restart. It’s important to remember that LaunchAgents are legitimate macOS features and their presence does not inherently signify malware.

The screenshot also raised concerns about potential credential exposure on the Mac, including the user’s GitHub login. This warning indicates a possibility of exposure, not confirmed theft. The publicly available evidence does not confirm that passwords, access tokens, source code, or other files were exfiltrated. The initial infection vector and the full extent of the compromise remain unknown.

Initially, Claude reported that it had not taken any action to terminate or remove the miner. Instead, it sought permission to stop the startup item and the miner, then move the associated files into quarantine. UntilHEX later confirmed that the AI assistant did perform cleanup actions, though one file required manual deletion due to an access permission issue.

The observed behavior aligns with techniques commonly employed in other macOS threats, although no direct link has been established. Previous reports on HackersRadar have detailed fake CAPTCHA attacks that install backdoors and XMRig, often leveraging LaunchAgents and combining mining with password theft. This demonstrates why removing a miner alone may not fully mitigate all associated risks.

Separate reporting on the CrashStealer campaign, which exploited Apple’s crash-reporting branding, also documented the use of LaunchAgent for persistence. Neither of these campaigns has been definitively linked to UntilHEX’s Mac. Their relevance lies in the shared tactic of utilizing trusted operating system features to maintain the execution of unwanted software.

What You Should Do

• Investigate Anomalies: Promptly investigate any unexplained system heat, persistent high CPU usage, or sluggish performance on your Mac.
• Review LaunchAgents: Regularly inspect the contents of ~/Library/LaunchAgents/ and /Library/LaunchAgents/ for any suspicious or unrecognized entries.
• Change Passwords: If you suspect a compromise, immediately change all critical passwords (email, banking, social media, GitHub, etc.) from a clean, trusted device.
• Isolate and Scan: Disconnect the affected device from the network to prevent further spread or data exfiltration. Perform a full system scan with reputable antivirus and anti-malware software.
• Backup and Reinstall (if necessary): For severe or persistent infections, consider backing up essential data and performing a clean reinstallation of macOS.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.